Types of Penetration test to detect and manage potential vulnerability

Penetration test or Pen test as we call it, is an intentional attack on a systems hardware or software to expose the security vulnerabilities and security flaws that violates the systems integrity and compromises confidential data. The security penetration test helps uncover the critical security flaws in a system and further helps understand the level of intrusion that led to the complete security lapse in the system. To understand the scope of the Pen test, we have discussed the different types of penetration tests and its benefits. This information will help companies decide the most relevant type of penetration test required for their systems and what to expect from it.

Types of Penetration test & their benefits

Primarily, there are 5 main types of penetration testing available, with each of it resolving different types of security issues. For the company’s planning to take up a Pen test on their system, it is important to understand the differences, to know which type of test shall meet their system requirements and objectives.

Network Penetration Test

Network Pen test is the most common and in demand requirement for Pen testers. Typically, this type of test helps detect and expose the vulnerabilities in a client’s network infrastructure. Since the network has both internal and external access points, it is essential for companies to run tests locally at the client site and remotely as well. The test generally targets the following network areas in their penetration tests.

• Firewall configuration 
• Firewall bypass testing
• Stateful analysis testing.
• IPS deception
• DNS level attacks 

Benefits of the Network penetration testing

The external network pen test helps probe your perimeter defences, and highlights how externally-facing network infrastructure responds to threats, and further exposes the potential weaknesses and vulnerabilities. On the other hand, an internal network pen test critically assesses the potential of exploit by an internal user, or an unauthorised attack by an employee of the organization. With this you would also be able to assess the severity and potential of an unauthorised access and leak of confidential, sensitive or personal information from within the organization.

Web application penetration test

A web application pen test is all about checking on potential security issues or lapse caused due to the insecure development, design or coding. The test helps identify potential vulnerabilities in the websites and web applications, including CRM, and internal or externally developed programs that could lead to leaking of personal and confidential data. The test is mainly targeted to areas like web applications, browsers, and other components like Plug-ins, Applets etc. 

Benefits of the Web app testing

In the growing digital world, with more web-based portals, online shopping platforms and internet banking in use, organisations are looking to build their businesses safe. Digitization of business has also scaled the complexity, and potential of exploitation and vulnerabilities in an organization’s web application. Internet-based web applications can be easily accessible, probed, and manipulated from any remote place. However, a thorough Web app pen test can reduce or limit such risk faced by organisations by analysing and bridging the loose ends and loop holes to security lapse.

Social engineering pen test 

Social engineering is an important part of penetration testing. It is a test that verifies the “Human Network” of an organization. The test helps secure an attempt of potential attack from within the organization by an employee looking to initiate a breach or an employee being manipulated into sharing details. This kind of test includes both Remote penetration test and Physical penetration test which targets most common types of social engineering tactics used by ethical hackers like phishing attacks, imposters, tailgating, pre-texting, gifts, dumpster diving, eavesdropping to name a few. 

Benefits of social engineering penetration test

Social engineering pen testing can reveal a lot about the cyber security awareness levels of employees, and their level of compliance with existing security policies in place. It also highlights network or software vulnerability of the system and helps bridge the gap.

Wireless network test

Wireless network test is more about analysing the wireless devices like tablets laptop, notebook, ipods drives, smartphones etc.As the name suggests the test involves examining all of the wireless devices to find any security loop holes and determine devices that are deemed to be “weak” or “rogue”. Apart from the gadgets, the penetration test considers testing administration credentials to identify the ones violating the access rights.

Benefits of network pen test

The test helps detect weak access points and possibility of identifying vulnerabilities within the common business applications, devices and infrastructure. The test can limit and secure the poorly secured wireless networks used for hacking into organizations confidential data.

Client-side test

Client-side test which is also known as an internal test is conducted to identify potential security threats that could emerge from within the organization. This could be a flaw in software application run on the user’s workstation which a hacker can easily exploit. The act of exploiting can be in the form of exploiting vulnerabilities in client-side application like via emails, web browsers, Macromedia Flash, Adobe Acrobat and other such mode. A hacker can exploit a vulnerable application through a smartly-crafted email or by enticing the employee to visiting a malicious web page or by malware loaded on USB sticks that are automatically executed once inserted in the user’s workstation. However, running the client-side test can detect the flaw and limit the data breach and system vulnerability. 

Benefits of client-side test

The client-side security penetration testing helps identify security vulnerabilities in client-side software installed in the company’s workstations and also detect the user’s insecure behaviour. It can further determine if employees are following all the standard security practices to prevent client-side attack. The test can highlight the overall security scenario and further raise risk and security awareness in the organization.

This article originally published on the VISTA InfoSec blog at

https://www.vistainfosec.com/blog/types-of-penetration-test/